langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 13:05:55 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Password hash iterations for enhanced security #20505

New Issue
Closed
opened 2026-02-21 20:07:44 -05:00 by yindo · 3 comments
yindo commented 2026-02-21 20:07:44 -05:00
Owner
Copy Link
Copy Source

Originally created by @BenjaminX on GitHub (Nov 24, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

Summary

The current password hashing implementation uses a hardcoded 10,000 PBKDF2 iterations, which no longer meets modern security standards. This issue proposes making the iteration count configurable to allow enhanced security while maintaining backward compatibility.

Problem

Current State

  • Password hashing uses a fixed 10,000 PBKDF2-HMAC-SHA256 iterations
  • This iteration count was considered secure years ago but is now below recommended standards
  • No option to increase security for production deployments
  • in configs/feature/__init__.py:

Security Concerns

According to OWASP Password Storage Cheat Sheet:

  • 2023 Recommendation: Minimum 600,000 iterations for PBKDF2-HMAC-SHA256
  • 2025 Standards: Even higher iteration counts are recommended as computational power increases
  • Current 10,000 iterations provide insufficient protection against brute-force attacks

2. Additional context or comments

Related PR

#28374

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @BenjaminX on GitHub (Nov 24, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. ## Summary The current password hashing implementation uses a hardcoded 10,000 PBKDF2 iterations, which no longer meets modern security standards. This issue proposes making the iteration count configurable to allow enhanced security while maintaining backward compatibility. ## Problem ### Current State - Password hashing uses a fixed 10,000 PBKDF2-HMAC-SHA256 iterations - This iteration count was considered secure years ago but is now below recommended standards - No option to increase security for production deployments - in `configs/feature/__init__.py`: ### Security Concerns According to [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): - **2023 Recommendation**: Minimum 600,000 iterations for PBKDF2-HMAC-SHA256 - **2025 Standards**: Even higher iteration counts are recommended as computational power increases - Current 10,000 iterations provide insufficient protection against brute-force attacks ### 2. Additional context or comments ## Related PR #28374 ### 3. Can you help us with this feature? - [x] I am interested in contributing to this feature.
yindo added the 💪 enhancement label 2026-02-21 20:07:44 -05:00
yindo closed this issue 2026-02-21 20:07:44 -05:00
yindo commented 2026-02-21 20:07:44 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 25, 2025):

Hi, @BenjaminX. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You raised a concern about the fixed 10,000 PBKDF2 iterations used for password hashing being outdated.
  • You proposed making the iteration count configurable to align with modern security standards like OWASP's recommendation of 600,000 iterations.
  • You expressed interest in contributing to this improvement.
  • There has been no further activity or discussion on this issue since your initial report.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of Dify by commenting here.
  • If I don’t hear back within 15 days, I will automatically close this issue.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Dec 25, 2025): Hi, @BenjaminX. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You raised a concern about the fixed 10,000 PBKDF2 iterations used for password hashing being outdated. - You proposed making the iteration count configurable to align with modern security standards like OWASP's recommendation of 600,000 iterations. - You expressed interest in contributing to this improvement. - There has been no further activity or discussion on this issue since your initial report. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of Dify by commenting here. - If I don’t hear back within 15 days, I will automatically close this issue. Thank you for your understanding and contribution!
yindo commented 2026-02-21 20:07:44 -05:00
Author
Owner
Copy Link
Copy Source

@BenjaminX commented on GitHub (Dec 26, 2025):

Hi, @BenjaminX. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You raised a concern about the fixed 10,000 PBKDF2 iterations used for password hashing being outdated.
  • You proposed making the iteration count configurable to align with modern security standards like OWASP's recommendation of 600,000 iterations.
  • You expressed interest in contributing to this improvement.
  • There has been no further activity or discussion on this issue since your initial report.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of Dify by commenting here.
  • If I don’t hear back within 15 days, I will automatically close this issue.

Thank you for your understanding and contribution!

yes, pls code review and merge PR https://github.com/langgenius/dify/pull/28374

@BenjaminX commented on GitHub (Dec 26, 2025): > Hi, [@BenjaminX](https://github.com/BenjaminX). I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. > > **Issue Summary:** > > * You raised a concern about the fixed 10,000 PBKDF2 iterations used for password hashing being outdated. > * You proposed making the iteration count configurable to align with modern security standards like OWASP's recommendation of 600,000 iterations. > * You expressed interest in contributing to this improvement. > * There has been no further activity or discussion on this issue since your initial report. > > **Next Steps:** > > * Please let me know if this issue is still relevant to the latest version of Dify by commenting here. > * If I don’t hear back within 15 days, I will automatically close this issue. > > Thank you for your understanding and contribution! yes, pls code review and merge PR https://github.com/langgenius/dify/pull/28374
yindo commented 2026-02-21 20:07:44 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 26, 2025):

Thank you for your response and for submitting the PR! We appreciate your contribution and will review it shortly. Closing this issue now.

@dosubot[bot] commented on GitHub (Dec 26, 2025): Thank you for your response and for submitting the PR! We appreciate your contribution and will review it shortly. Closing this issue now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 💪 enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20505
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?